DHCP Server RADIUS Proxy

The Dynamic Host Configuration Protocol (DHCP) Server RADIUS Proxy is a RADIUS-based address assignment mechanism in which a DHCP server authorizes remote clients and allocates addresses based on replies from a RADIUS server.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see
Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Prerequisites for DHCP Server RADIUS Proxy

Before you can configure the DHCP Server RADIUS Proxy, you must be running DHCPv4 or a later version. For information about release and platform support, see "Feature Information for DHCP Server RADIUS Proxy".

Restrictions for DHCP Server RADIUS Proxy

The DHCP Server RADIUS Proxy supports only one address authorization pool on the router.

The router determines the address of the DHCP server from the IP helper address on the interface that receives the DHCP packet.

RADIUS receives an access-request message to translate the DHCP options to RADIUS attributes.

RADIUS responds with an access-accept message, and delivers the following attributes to the DHCP server:

Framed-IP-Address

Framed-IP-Netmask

Session-Timeout

Session-Duration

The DHCP server sends an OFFER unicast message containing the following translations from the RADIUS server access-accept message to the client:

Framed-IP-Address inserted into the DHCP header.

Framed-IP-Netmask inserted into DHCP option 1 (subnet mask).

Session-Timeout inserted into DHCP option 51 (IP address lease time).

Framed-Route that is translated from the standard Cisco Framed-Route format into DHCP option 121 or the DHCP default gateway option (if the network and netmask are appropriate for a default route).

A copy of relay agent information (option 82). Before the DHCP client receives the packet, the relay removes option 82.

T1 time set to the Session-Timeout and T2 time set to the Session-Duration.

The client returns a formal request for the offered IP address to the DHCP server in a DHCP REQUEST broadcast message.

The DHCP confirms that the IP address is allocated to the client by returning a DHCP ACK unicast message containing lease information and the DHCP options to the client.

A RADIUS server accounting request starts, followed by a RADIUS server accounting response that is used by the AAA subsystem.

When a RADIUS server attribute is not present in an access-accept message, the corresponding DHCP option is not sent to the DHCP client. If the required information to produce a particular RADIUS server attribute is not available to the DHCP server, the DHCP server does not include information in the RADIUS packet. Non-inclusion can be in the form of not sending an attribute (if there is no information at all), or omitting information from the attribute (in the case of CLI-based format strings).

If a DHCP option is provided to the DHCP server but is invalid, the DHCP server may not transmit the corresponding RADIUS attribute in the access-request, or may transmit an invalid RADIUS server attribute.

DHCP Server and RADIUS Translations

The table below lists the translations of DHCP options in a DHCP DISCOVER message to attributes in a RADIUS server access-request message.

The table below lists the translations of attributes in a RADIUS server access-accept message to DHCP options in a DHCP OFFER message.

Table 2 RADIUS Access-Accept to DHCP OFFER Translations

RADIUS Access-Accept

DHCP OFFER

Framed-IP-Address

IP address of the residential gateway

Framed-IP-Netmask

Subnet mask (option 1)

Session-Timeout

IP address lease time (option 51)

Cisco AV pair session-duration in seconds, where seconds is greater than or equal to the number of seconds in the Session-Timeout attribute.

Provides session control on the DHCP server. This attribute is not transmitted to the DHCP client.

Framed-Route (RADIUS attribute 22). One route for each DHCP option is allowed with a maximum of 16 Framed-Route options for a RADIUS packet.

Contains up to 16 classless routes in one option (option 121)

RADIUS Profiles for DHCP Server RADIUS Proxy

When you configure RADIUS server user profiles for DHCP server RADIUS proxy, use the following guidelines:

The Session-Timeout attribute must contain a value, in seconds. If this attribute is not present, the DHCP OFFER is not sent to the client.

A RADIUS user profile must contain the following attributes:

Framed-IP-Address

Framed-IP-Netmask

Framed-Route

Session-Timeout

Session-Duration--Session-Duration is the Cisco AV pair session-duration = seconds, where seconds is the maximum time for the duration of a lease including all renewals. The value for Session-Duration must be greater than or equal to the Session-Timeout attribute value, and it cannot be zero.

Additional RADIUS server attributes are allowed but are not required. The DHCP server ignores additional attributes that it does not understand. If a RADIUS server user profile contains a required attribute that is empty, the DHCP server does not generate the DHCP options.

method-list-name--Character string to name the authorization methods list.

group--Specifies a server group.

group-name--Name of the server group to apply to DHCP authorization.

Step 9

aaaaccountingnetworkmethod-list-namestart-stopgroupgroup-name

Example:

Router(config)# aaaaccountingnetworkacct1start-stopgroupgroup1

Specifies that AAA accounting runs for all network service requests.

method-list-name--Character string to name the accounting methods list.

start-stop--Sends a start accounting notice at the beginning of a process and a stop accounting notice at the end of a process. The start accounting record is sent in the background. The requested user process begins regardless of whether or not the start accounting notice is received by the accounting server.

(Optional) Enables IEEE 802.1Q encapsulation of traffic on a subinterface in a virtual LAN (VLAN).

vlan-id--VLAN ID, integer in the range 1 to 4094. To separate the starting and ending VLAN ID values that are used to define a range of VLAN IDs, enter a hyphen. (Optional) To separate each VLAN ID range from the next range, enter a comma.

Specifies the authentication and encryption key for all RADIUS communications between the router and the RADIUS daemon.

0string--Specifies an unencrypted (cleartext) shared key

7string--Specifies a hidden shared key.

Note

Any key you enter must match the key on the RADIUS daemon. All leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks are part of the key.

(Optional) Displays a list of all bindings created on a specific DHCP server.

Use the showipdhcpbinding command to display the IP addresses that have already been assigned. Verify that the address pool has not been exhausted. If necessary, re-create the pool to create a larger pool of addresses.

Use the showipdhcpbinding command to display the lease expiration date and time of the IP address of the host.

Step 5

showipdhcpserverstatistics

Example:

Router# show ip dhcp server statistics

(Optional) Displays count information about server statistics and messages sent and received.

Step 6

showipdhcppool [name]

Example:

Router# showipdhcppool

(Optional) Displays the routes added to the routing table by the DHCP server and relay agent.

Step 7

showiproutedhcp [address]

Example:

Router# showiproutedhcp[address]

(Optional) Displays information about DHCP address pools.

Configuration Examples for DHCP Server Radius Proxy

Configuring the DHCP Server Example

The following example shows how to configure a DHCP server for RADIUS-based authorization of DHCP leases. In this example, DHCP clients can attach to Ethernet interface 4/0/1 and Ethernet subinterface 4/0/3.10. The username string (%c-user1) specifies that the RADIUS server sends the Ethernet address of DHCP client named user1 to the DHCP server.

RFCs

No new or modified RFCs are supported by this feature, and support for existing RFCs was not modified by this feature.

--

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

Feature Information for DHCP Server RADIUS Proxy

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Table 3 Feature Information for the Cisco IOS XE DHCP Relay Agent

Feature Name

Releases

Feature Configuration Information

DHCP Server RADIUS Proxy

Cisco IOS XE Release 2.4

Cisco IOS XE Release 3.9S

DHCP Server RADIUS Proxy enables a server to authorize remote clients and allocate addresses based on replies from the server.

In Cisco IOS XE 2.4, this feature was introduced on the Cisco ASR 1000 Series Aggregation Services Routers.

The following commands were modified by this feature:
authorizationmethod(dhcp),
authorizationshared-password,authorizationusername(dhcp).

Glossary

client--A host trying to configure its interface (obtain an IP address) using DHCP or BOOTP protocols.

DHCP--Dynamic Host Configuration Protocol.

giaddr--Gateway IP address. The giaddr field of the DHCP message provides the DHCP server with information about the IP address subnet on which the client is to reside. It also provides the DHCP server with an IP address where the response messages are to be sent.

relayagent--A router that forwards DHCP and BOOTP messages between a server and a client on different subnets.

server--DHCP or BOOTP server.

VPN--Virtual Private Network. Enables IP traffic to use tunneling to travel securely over a public TCP/IP network.

VRF--VPN routing and forwarding instance. A VRF consists of an IP routing table, a derived forwarding table, a set of interfaces that use the forwarding table, and a set of rules and routing protocols that determine what goes into the forwarding table. In general, a VRF includes the routing information that defines a customer VPN site that is attached to a PE router. Each VPN instantiated on the PE router has its own VRF.